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WHAT IS CLAIMED IS: 



K A systsm for managmg a dommunicatioii si^ssion over a computer 
network that includes a gatekeeper, tlie system comprising: 

(a) a network connector for connecling lo die computer network and for 
receiving data packets from the computer nenvodq 

(b) a filtering unit for filtering said data packets and for accepting said data 
packets substantially only if said data piickets contain data selected from 
Ihe group consisting of audio data and video data, such that said data 
packets form at least a portion of the conmiunicalion session and such 
that said data packets are selected data packets; 

(c) a management unit for receiving said selected data packets and for 
storing said selected data packets, <iucli diat said selected data packets 
are stored data packets; 

(d) a storage Tncdium for receiving and tor storing said stored data packer 
from said management unit, inch that said at least a portion of the 
coniiBuniicatiofi session is stored; and 

(e) a link, between the gatekeeper and said management unit, for 
transferring information related to said data packets Irom the gatekeeper 
to said management unit 



2. 

(f) 



Tlie system of claim 1 , further comprising: 

a data restore unit for retrieving and displaying said at least a portion of 
the communication session, said data reslarc xmit requesting said data 
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packets fiom said storage medium through said management imit, and 
said data restore unit reconstructing said data packets for displaying said 
at least a portion of the coiuniuxiication session. 



3, The system of claim 2, wherein said data restore unit further comprises a 
communication session display unit for displa>nng said al least a poruon of the 
communication session. 



4. The system of claim 3, wherein said communication session display unit 

y is selected Irom the group consisting of a video unit and an audio unit, 

if! 

y 5, The system of claim 2, further comprising; 

ill 

\f\ (g) a database connected to iaid filtering unit for storing filtering 

i2 information, said filtering infonnation including at least one IP address 

i ^ of a party whose communication sessions are monitored; 

,Z wherein said fiitering unit accepts said data packets according to st\id fihering 

i j-i 

: — ^ 

information, such that said filteriug unit substantially only accepts said data packets if 
said data packets fulJBll said filtering information. 



6, The system of claim 5, further comprising: 

(h) a user compLiter for receiving at least one command of a user and for 
displaying iiiformaUun to said user, such that said user determines said 
fihering information according to said at least one command of said 
user. 
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7. The system of claim 6, wherein the cympiiler netwojck, is selected from 
the group consisting ol a LAN (local area network) and a WAN (^ide area network). 

8. The system of claim 7, wherein the computer network is a LAM (local 
area network). 

9. rhe system of claim 8, wherein said LAN is divided into at least two 
segi-neni^i, the fsystem further comprising: 

= D a local management unit for each segment, said local management unit 

including yaid filtering unit and said management unit; and 
^sJ (j) a centTdl management unit for controlling said local tnanagement units, 

ijl said ceniral management unit controlling storage in said storage 

in medium, 

■ tXT 

' scr 
. ft 

|~ 10. Tlic system of claim L wherein said nctwwk connector is a network 

interface card. 



IL A method for conducting a communication session on a computer 
network between a packet source and a packet destination, comprising the steps of 

(a) setting up the communication session according to a first protocol suite; 
and 

(b) storing at least a portion of die communication session according to a 
second protocol suite different from said first protocol 5idte, said storing 



i5;Ci9 
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being pertbmied by a data processor 



12. The method of daiin 11, wherein said second protocol i;uite is an DP 
protocol SLiite. 

13. The method of clalira 11, wherein said storing is effected by steps 



(i) recehing n data packet troni the packet source on the computer network; 

(ii) analyzing said data packet to determine if said data packet is in 
accordance witli said se(;ond protocol suite; and 

(iii) storing said data packet to form a stored data packet, such Lhat said 
stored data packet forms at least a portion of the communication session. 

14, The method of claim 13, wherein the step of analyzing said data packet 
is perfoinied by examining a header of said data packet. 

15. The method of claim wherein the slqp of storing said at least a 
portion of the communication session further comprises ihe step of: 

(iv) subseqtjent to said anai>'zing, if said data packet is in accordance with 
sitid second protocol suite, filtering said data packet to determine a t>'pe 



16- The method of claim 15, wherein the step of analyzing said data packet 
is performed by examining a header of said data packet. 



including: 



of said data packet 
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1 7. The method of claim 16, wherein the step of filtering said data packet is 
performed by examining said header of said data packet. 

The method of claim 17. wherein said second protocol suite is an IP 
protocol suite, wherein said data packet in accordance with said second protocol suite is 
an IP packet, and wherein the step of filtering said IP packet further comprises the steps 



(A) examining said header of said IP packet to determine an IP address of 

said packet source; 
(Ii) determining if said IP address is a recorded IP address; 
(C!) passing said IP packet to form a passed IP packet substantially only if 

said IP address is said recorded IP address; and 
(D) alternatively, dimiping said IP packet 

19. The method of claim 18, wherein the step of determining if said IP 
address ijj said recorded IP address is performed by comparing said IP address to a list 
of IP addresses irom packet sources, such that if said IP address is included in said list, 
said IP address is said recorded IP address. 

20. The method of claim 18, wherein if said passed IP packet is an RTP 
packet, storing said RTP packet. 
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21. The metiiod of claim LS, wherein Lf said passed IP packet is an RTCP 
packet, storing iund RTCP packet. 



22- The method of claim 15, wherein sa5d storing of said dyia packet is 
etTecied according to said tv-pe of said data packet 

23. The method of claim 13. wherein the step of storing at least a portion of 
the coniniuiiicatiori session furthcfr comprises the steps of: 

(iv) ictrieving said stored data packet to Tumi a retrieved data packet; and 

(v) reconsiructiao at least a portion of the communicaiioB session according 
to said retrieved data packet, 

24. The method of claim 23, wherein :>iiid second protocol suite is an 1? 
protocol suite, and wherein the step of'retrievjng said data packet includes the steps of: 

(A) receiving a source IP address of the packet source, a start trnie of the 
coinmuD.ication sessions ai*»d an end rime of ihe cominunication session; 
and 

CB") selecting at least one comniLmication session according to said source fl-* 
address, said start time and said end time. 

25. The method of claim 23, wherein said second protocol suite is lui IP 
protocol suite, and wherein the step of retrieving said data packet includes the steps of: 

(A) receiving identifying information related to the cominunicaiion session, 
a start time of the communication session and an end time of the 
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coiimiuiiication session; 



(B) 



inferring a source IP address from said idenufying iiifonnation; and 



(C> selecting at leasl one coriimuiiication session according to said source IP 
address, said start umc and said end lime. 

26. Tlie method of claim 23, wherein the slep of reconstructing at least a 
portion of the coimnuiiication session includes displacing audio data. 

27. The method of claim 23, wherein the step uf reconstructing at least a 
portion of the comniujuuatioii session includes displaying video data. 

The method of ciaim 23, wherein said second protocol suite is an JP 
protocol suite, and wherein the step of reconstructing at leaijl a portion of the 
conmiunicaiiun ijessioji further comprises the steps or 

(A) retrieving substantially only RTP packets, 

(B) cxaniinins a header of said RTP packets to determine a time stamp for 
each of J^id RTP packets; and 

(C) displaying said RTF packets in an order according to said time stamp. 



